cve.bz

CWE-311: Missing Encryption of Sensitive Data, page 5

Filter

The product does not encrypt sensitive or critical information before storage or transmission.

What the weakness is: CWE-311 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 14
  • CAPEC-31 Accessing/Intercepting/Modifying HTTP Cookies Likelihood: High · Severity: High
  • CAPEC-37 Retrieve Embedded Sensitive Data Likelihood: High · Severity: Very High
  • CAPEC-65 Sniff Application Code Likelihood: Low · Severity: High
  • CAPEC-157 Sniffing Attacks Severity: Medium
  • CAPEC-158 Sniffing Network Traffic Severity: Medium
  • CAPEC-204 Lifting Sensitive Data Embedded in Cache Severity: Medium
  • CAPEC-383 Harvesting Information via API Event Monitoring Severity: Low
  • CAPEC-384 Application API Message Manipulation via Man-in-the-Middle Severity: Low
  • CAPEC-385 Transaction or Event Tampering via Application API Manipulation Severity: Medium
  • CAPEC-386 Application API Navigation Remapping Severity: Medium
  • CAPEC-387 Navigation Remapping To Propagate Malicious Content Severity: Medium
  • CAPEC-388 Application API Button Hijacking Severity: Medium
  • CAPEC-477 Signature Spoofing by Mixing Signed and Unsigned Content Likelihood: Low · Severity: High
  • CAPEC-609 Cellular Traffic Intercept Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-311, as MITRE names them. Credits.

Ask an AI about CWE-311

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-311: Missing Encryption of Sensitive Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/311.html and https://cve.bz/cve/cwe/311?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2021-28496EPSS 0.4%

    On systems running Arista EOS and CloudEOS with the affected release version, when using shared secret profiles the password configured for use by BiDirectional Forwarding Detection (BFD) will be leaked when displaying output over eAPI or …

  2. 5.9CVE-2021-31386EPSS 0.7%

    A Protection Mechanism Failure vulnerability in the J-Web HTTP service of Juniper Networks Junos OS allows a remote unauthenticated attacker to perform Person-in-the-Middle (PitM) attacks against the device. This issue affects: Juniper Net…

  3. 6.8CVE-2021-3882EPSS 1.1%

    LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy. By tricking a user to use an unencrypted connection (HTTP), an attacker may be…

  4. 7.3CVE-2021-41302EPSS 0.4%

    ECOA BAS controller stores sensitive data (backup exports) in clear-text, thus the unauthenticated attacker can remotely query user password and obtain user’s privilege.

  5. 7.5CVE-2021-22932EPSS 0.4%

    An issue has been identified in the CTX269106 mitigation tool for Citrix ShareFile storage zones controller which causes the ShareFile file encryption option to become disabled if it had previously been enabled. Customers are only affected…

  6. 6.5CVE-2021-32001EPSS 0.3%

    K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the cluster's confidential keying material (cluster certificate authority private keys, secrets encryption configuration p…

  7. 7.5CVE-2021-33900EPSS 0.8%

    While investigating DIRSTUDIO-1219 it was noticed that configured StartTLS encryption was not applied when any SASL authentication mechanism (DIGEST-MD5, GSSAPI) was used. While investigating DIRSTUDIO-1220 it was noticed that any configur…

  8. 5.5CVE-2021-22782EPSS 0.1%

    Missing Encryption of Sensitive Data vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Process Expert (all versions, including all versions of EcoStruxure…

  9. 4.4CVE-2021-20567EPSS 0.1%

    IBM Resilient SOAR V38.0 could allow a local privileged attacker to obtain sensitive information due to improper or nonexisting encryption.IBM X-Force ID: 199239.

  10. 6.5CVE-2019-4471EPSS 1.0%

    IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for a sensitive cookie in an HTTPS session. A remote attacker could exploit this vulnerability t…

  11. 5.3CVE-2021-29248EPSS 0.8%

    BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the Secure flag for a cookie.

  12. 5.3CVE-2020-29024EPSS 0.5%

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in (GTA) GoToAppliance of Secomea GateManager could allow an attacker to gain access to sensitive cookies. This issue affects: Secomea GateManager all versions prio…

  13. 7.5CVE-2020-26732EPSS 1.5%

    SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission…

  14. 7.5CVE-2018-19944EPSS 0.8%

    A cleartext transmission of sensitive information vulnerability has been reported to affect certain QTS devices. If exploited, this vulnerability allows a remote attacker to gain access to sensitive information. QNAP have already fixed thi…

  15. 7.5CVE-2020-25842EPSS 0.5%

    The encryption function of NHIServiSignAdapter fail to verify the file path input by users. Remote attacker can access arbitrary files through the flaw without privilege.

  16. 7.5CVE-2020-35587EPSS 1.5%

    In Solstice Pod before 3.0.3, the firmware can easily be decompiled/disassembled. The decompiled/disassembled files contain non-obfuscated code. NOTE: it is unclear whether lack of obfuscation is directly associated with a negative impact,…

  17. 9.8CVE-2019-14480EPSS 1.1%

    AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web client, which can lead to an authentication bypass or escalation of privileges.

  18. 7.5CVE-2020-27055EPSS 0.6%

    In isSubmittable and showWarningMessagesIfAppropriate of WifiConfigController.java and WifiConfigController2.java, there is a possible insecure WiFi configuration due to improper input validation. This could lead to remote information disc…

  19. 7.5CVE-2020-28217EPSS 0.6%

    A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 (firmware 2.7 and older), that would allow an attacker to read network traffic over HTTP protocol.

  20. 7.5CVE-2020-28216EPSS 0.5%

    A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 (firmware 2.7 and older), that would allow an attacker to read network traffic over HTTP protocol.

  21. 5.9CVE-2020-4126EPSS 0.7%

    HCL iNotes is susceptible to a sensitive cookie exposure vulnerability. This can allow an unauthenticated remote attacker to capture the cookie by intercepting its transmission within an http session. Fixes are available in HCL Domino and …

  22. 5.7CVE-2020-7567EPSS 0.2%

    A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to find the password hash when the attacker has captured the traffic between EcoStruxure Mach…

  23. 4.1CVE-2020-8150EPSS 0.3%

    A cryptographic issue in Nextcloud Server 19.0.1 allowed an attacker to downgrade the encryption scheme and break the integrity of encrypted files.

  24. 2.2CVE-2020-8173EPSS 0.4%

    A too small set of random characters being used for encryption in Nextcloud Server 18.0.4 allowed decryption in shorter time than intended.

  25. 8.1CVE-2020-27651EPSS 0.8%

    Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP sess…

  26. 3.7CVE-2020-27650EPSS 0.6%

    Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an H…

  27. 7.5CVE-2020-9774EPSS 0.6%

    An issue existed with Siri Suggestions access to encrypted data. The issue was fixed by limiting access to encrypted data. This issue is fixed in macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierra…

  28. 7.5CVE-2020-15771EPSS 1.0%

    An issue was discovered in Gradle Enterprise 2018.2 and Gradle Enterprise Build Cache Node 4.1. Cross-site transmission of cookie containing CSRF token allows remote attacker to bypass CSRF mitigation.

  29. 5.3CVE-2020-15767EPSS 0.5%

    An issue was discovered in Gradle Enterprise before 2020.2.5. The cookie used to convey the CSRF prevention token is not annotated with the “secure” attribute, which allows an attacker with the ability to MITM plain HTTP requests to obtain…

  30. 6.5CVE-2020-2250EPSS 0.6%

    Jenkins SoapUI Pro Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by attackers with Extended Read permission, or access to the Jenki…

  31. 3.3CVE-2020-2249EPSS 0.3%

    Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.

  32. 4.3CVE-2020-2239EPSS 0.5%

    Jenkins Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.

  33. 3.3CVE-2020-4591EPSS 0.2%

    IBM Spectrum Protect Server 8.1.0.000 through 8.1.10.000 could disclose sensitive information in nondefault settings due to occasionally not encrypting the second chunk of an object in an encrypted container pool. IBM X-Force ID: 184746.

  34. 5.3CVE-2019-4686EPSS 0.4%

    IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link i…

  35. 4.4CVE-2020-3389EPSS 0.2%

    A vulnerability in the installation component of Cisco Hyperflex HX-Series Software could allow an authenticated, local attacker to retrieve the password that was configured at installation on an affected device. The vulnerability exists b…

  36. 5.3CVE-2020-9062EPSS 0.2%

    Diebold Nixdorf ProCash 2100xe USB ATMs running Wincor Probase version 1.1.30 do not encrypt, authenticate, or verify the integrity of messages between the CCDM and the host computer, allowing an attacker with physical access to internal A…

  37. 7.1CVE-2020-10124EPSS 0.7%

    NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt, authenticate, or verify the integrity of messages between the BNA and the host computer, which could allow an attacker with physical access to the internal components of the ATM …

  38. 8.1CVE-2020-10039EPSS 0.5%

    A vulnerability has been identified in SICAM MMU (All versions < V2.05), SICAM SGU (All versions), SICAM T (All versions < V2.18). An attacker in a privileged network position between a legitimate user and the web server might be able to c…

  39. 4.3CVE-2019-4704EPSS 0.6%

    IBM Security Identity Manager Virtual Appliance 7.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link…

  40. 9.1CVE-2020-12032EPSS 0.9%

    Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems store device data with sensitive information in an unencrypted database. This could allow an attacker with network access to view or modify sensiti…

  41. 4.6CVE-2019-18254EPSS 0.2%

    BIOTRONIK CardioMessenger II, The affected products do not encrypt sensitive information while at rest. An attacker with physical access to the CardioMessenger can disclose medical measurement data and the serial number from the implanted …

  42. 7.5CVE-2020-10273EPSS 0.9%

    MiR controllers across firmware versions 2.8.1.1 and before do not encrypt or protect in any way the intellectual property artifacts installed in the robots. This flaw allows attackers with access to the robot or the robot network (while i…

  43. 5.3CVE-2020-4233EPSS 0.8%

    IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within…

  44. 5.3CVE-2020-12801EPSS 1.3%

    If LibreOffice has an encrypted document open and crashes, that document is auto-saved encrypted. On restart, LibreOffice offers to restore the document and prompts for the password to decrypt it. If the recovery is successful, and if the …

  45. 7.5CVE-2020-12273EPSS 0.8%

    In TestLink 1.9.20, a crafted login.php viewer parameter exposes cleartext credentials.

  46. 7.5CVE-2020-10267EPSS 1.0%

    Universal Robots control box CB 3.1 across firmware versions (tested on 1.12.1, 1.12, 1.11 and 1.10) does not encrypt or protect in any way the intellectual property artifacts installed from the UR+ platform of hardware and software compon…

  47. 3.5CVE-2019-19090EPSS 0.5%

    For ABB eSOMS versions 4.0 to 6.0.2, the Secure Flag is not set in the HTTP response header. Unencrypted connections might access the cookie information, thus making it susceptible to eavesdropping.

  48. 7.5CVE-2019-15653EPSS 0.8%

    Comba AP2600-I devices through A02,0202N00PD2 are prone to password disclosure via an insecure authentication mechanism. The HTML source code of the login page contains values that allow obtaining the username and password. The username ar…

  49. 3.5CVE-2019-4616EPSS 0.3%

    IBM Cloud Automation Manager 3.2.1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the us…

  50. 5.3CVE-2015-0558EPSS 1.2%

    The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6, and possibly other routers, uses "1236790" and the MAC address to generate the WPA key.